Nothing that happened in 2026 gives a hospital, a warehouse, a data center, or a campus any authority to do anything at all to a drone flying over it. If an officer calls the console at two in the morning and says there's something hovering over the helipad, the legal answer today is what it was five years ago, which is watch it, write it down, and call somebody. The rulemaking language this year reads like relief is coming, and the trade press has been covering it that way.

In May the FAA published a proposed rule with the unlovely title "Designation-Restrict the Operation of Unmanned Aircraft in Close Proximity to a Fixed Site Facility," which would create a new Part 74 and let the operator of a fixed site petition for what the agency is calling an Unmanned Aircraft Flight Restriction. If the FAA grants it you get restricted airspace over your property, typically capped at 400 feet and drawn to your property boundaries, and a drone inside it is operating unlawfully. Sixteen critical infrastructure sectors are eligible to ask, healthcare among them. The comment window closed July 6 and the FAA is projecting more than nine thousand applications in the first five years, which tells you what the agency thinks demand looks like.

The rule also anticipates the obvious question and answers it in its own text. Designations under Part 74 do not confer counter-UAS authorities granted by Congress. The airspace over your property becomes restricted and you still cannot lay a finger on a drone sitting in it.

The second piece is the SAFER SKIES Act, which Congress passed in December 2025 inside the FY2026 defense authorization, and the DOJ and DHS interim final rule implementing it took effect July 1. That one is a genuine expansion. State, local, tribal, and territorial law enforcement and corrections agencies can now detect and track drones, and in defined circumstances disable or seize them, which was federal-only authority before. It runs on a two-tier certification. Tier 1 covers detection and warning and an agency can earn it with an online assessment. Tier 2 is the one that lets anybody actually take a drone down, and it requires in-person training at the FBI's National Counter-UAS Training Center. An officer holding Tier 1 cannot take a Tier 2 action even in an emergency. The rule says so in as many words, so somebody clearly asked.

So the mitigation authority is real and it sits with your local police department, assuming your local police department has gotten somebody through the FBI course, which almost none of them have yet.

The private operator is absent from both. In the FAA rule you show up as a petitioner filling out paperwork, and in the SAFER SKIES rule you don't show up at all. Every counter-drone product being sold into corporate security right now either detects, which is legal, or mitigates, which is not legal for you and does not become legal on the strength of a purchase order. The federal criminal statutes on interfering with aircraft didn't move an inch this year.

What's left to the security program is detection, documentation, and a notification path that works, and all of that is written rather than purchased, which ought to be good news because it means a facility with no budget at all can have the whole thing by Friday.

Create a call type in your CAD. Give the console a short form for it, meaning time, location, direction of travel, altitude estimated against something known like the roofline or a light pole, and behavior, because a drone loitering over one spot is a different report than a drone transiting the property. Put the FBI field office number and the FAA regional operations center number in the post order next to the ones already there. Decide in advance, in writing, who at your facility is authorized to call them, because at two in the morning that decision doesn't get made well.

The piece almost nobody is picking up is Remote ID. Most drones flying legally in this country have been broadcasting their own identity since March 2024, including a serial number, position, altitude, and in a lot of cases the location of the person flying it. That broadcast is public and the receiving app is free and runs on a phone. An operator standing at a window can capture the identity of the aircraft over the property, which is the first thing law enforcement will ask for and the thing nobody currently has. There's no rule against listening to a broadcast that's aimed at everybody.

On March 1 Iranian drones struck Amazon Web Services facilities in the United Arab Emirates and Bahrain and knocked availability zones offline, with damage confirmed across three sites. It was the first time a state deliberately went after commercial data centers as part of a war. The FAA proposal landed nine weeks later.

Section 2209 of the FAA Extension, Safety, and Security Act of 2016 directed the FAA to build a process for protecting fixed sites from drones. The proposal arrived in May of 2026. In the ten years between, the drone went from a mall kiosk novelty to a weapon of war, and the paperwork to keep one off your roof reached the comment stage this spring. If you're waiting on a rule to arrive before you write your own procedure, you're well behind the game.

The drone will show up eventually. Usually it's a kid with a camera, once in a while it's somebody taking a real good look at your roof, and either way your officer is going to watch it for a few seconds and then look at the console, and whatever's written down at that moment is the program. For most places right now that's a blank page and a guy squinting at the sky.

SCC Spectrum Security Almanacs

Officers know their posts. They were trained on the position, they have worked it, and the ones who have been there a while carry things about that building that were never written down anywhere. The post order is supposed to be where that knowledge sits on paper. It drifts out of date faster than anyone notices, because the building keeps changing and the binder does not.

Pull the post orders on a schedule and check them against the building. Once a quarter, a few posts at a time, somebody walks the post with the page in hand and reads it against what is actually in front of them. It costs nothing. You already own the binder and the officer is already walking.

A post order that still says to lock a door somebody bricked up six years ago is not confusing anyone on nights. The officer working that post knows the door is gone. It becomes a problem the day somebody who has never worked it has to cover it, and it becomes a much larger problem in a deposition, where the written version of your program is the only version that exists.

Track two numbers. The date of last revision on each post order, and how many of your posts have been walked against the page in the last twelve months. If the second number is zero, the first one is all you have.

Next time you are out, take the page for that post with you and ask the officer what is on it that is not true anymore. They will know.

Apex AI: Join the waitlist

The National Retail Federation put out its 2026 theft and violence report last week, and the headline number is good news. Shoplifting incidents fell 12.4% between 2024 and 2025, and merchandise theft fell 8.1%. Retailers hardened stores, locked up product, and put people through training, and the numbers came down.

63% of retailers report fewer than half of their incidents to police. When asked why, 60% said the dollar value was too low to bother and 54% said they didn't expect law enforcement to follow up. Half of respondents also said repeat offenders are getting worse, which is a strange thing to sit next to a 12% decline.

Those findings are in tension and the survey can't resolve them. Both are self-reported counts of things somebody decided to write down. A company that has stopped recording low-dollar incidents produces the exact same chart as a company that stopped getting robbed.

The 12.4% is the number that lands in board decks this fall. Under it is a reporting rate that keeps falling for reasons the respondents stated plainly, that the dollar value is too low and nobody expects follow-up. A voluntary survey cannot separate a store that got safer from a store that quit writing things down, and NRF and LPRC do not claim it can. The report is an accurate picture of what retailers recorded. Whether that is the same picture as what happened on the floor is the open question, and it is the one the decline does not answer.

SCC Spectrum Security Almanacs

Sunday into Monday, five sites, quiet one. Liquor store alarm at ten after one, it was the back door not seated right again, same as the last four times. Donna's got a dentist thing Thursday so Ronnie's covering the front half of her circuit, that's already squared away.

Now. Mikey's got us pulling post orders and walking them against the actual building. I wrote a good chunk of them post orders myself back when Marty was running the account, so youse can imagine how thrilled I was.

Bank branch. Nothing on the bulletin board. I find the thing down behind the desk, between the desk and the wall, must've come off the board and nobody noticed. Could've been down there a year.

So I read it. It says secure the side door by the vestibule at close. They filled that door in. Bricked it up six years ago, I watched them do it. Further down, escalation contact is Carl. Carl retired in 2019. There's a number under his name that I would bet you money rings in somebody's kitchen.

Sent the whole thing up. Took about a month but it got fixed.

Two weeks ago I'm off, and Joey's got a guy in the bank vestibule at four in the morning who don't want to leave and is getting loud about it. Joey goes to the sheet, dials the number, gets an actual person on the second ring, handled in eleven minutes.

We're pulling the rest of them this week. My idea, if anybody asks.

The number that worked was the one somebody found on the floor and fixed. A post order is only a standard if somebody checks it against the building.

SCC Spectrum Security Almanacs. www.gsoc911.com/products